etymd 0.2.1 → 0.3.0

package/dist/chunk-YLNQQZ5F.js

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+import { execFile } from 'node:child_process';
+import { promises } from 'node:fs';
+import { promisify } from 'node:util';
+
+var pExecFile = promisify(execFile);
+async function pathExists(p) {
+  try {
+    await promises.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readJson(p) {
+  try {
+    const raw = await promises.readFile(p, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function readText(p) {
+  try {
+    return await promises.readFile(p, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function isDirectory(p) {
+  try {
+    return (await promises.stat(p)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function git(root, args) {
+  try {
+    const { stdout } = await pExecFile("git", args, { cwd: root, timeout: 4e3 });
+    return stdout.trim();
+  } catch {
+    return null;
+  }
+}
+function wordCount(text) {
+  const m = text.trim().match(/\S+/g);
+  return m ? m.length : 0;
+}
+function approxTokens(words) {
+  return Math.round(words / 0.75);
+}
+var CI_ENV_VARS = [
+  "CI",
+  "GITHUB_ACTIONS",
+  "GITLAB_CI",
+  "BUILDKITE",
+  "CIRCLECI",
+  "JENKINS_URL",
+  "TF_BUILD"
+];
+function isCiEnvironment() {
+  return CI_ENV_VARS.some((v) => Boolean(process.env[v]));
+}
+function normalizeRelPath(p) {
+  return p.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+}
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        i += 1;
+        if (glob[i + 1] === "/") {
+          i += 1;
+          re += "(?:.*/)?";
+        } else {
+          re += ".*";
+        }
+      } else {
+        re += "[^/]*";
+      }
+    } else if (c === "?") {
+      re += "[^/]";
+    } else {
+      re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${re}$`);
+}
+function matchesGlob(p, glob) {
+  const target = normalizeRelPath(p);
+  const pattern = normalizeRelPath(glob);
+  if (!pattern) return false;
+  if (!/[*?]/.test(pattern)) return target === pattern || target.startsWith(pattern + "/");
+  return globToRegExp(pattern).test(target);
+}
+function matchesAnyGlob(p, globs) {
+  return globs.some((g) => matchesGlob(p, g));
+}
+
+export { approxTokens, git, isCiEnvironment, isDirectory, matchesAnyGlob, normalizeRelPath, pathExists, readJson, readText, wordCount };

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-C4Z6NXDO.js';
+import { VERSION } from './chunk-NFENQ3IK.js';
 import path from 'node:path';
 import { Command } from 'commander';
 import pc from 'picocolors';
@@ -31,7 +31,7 @@ program.command("audit").description("Verify every instruction claim against the
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./audit-YH74YZFQ.js');
+    const { run } = await import('./audit-GYZ5YZ7U.js');
     await run({
       cwd: resolveCwd(cmd),
       json: opts.json,
@@ -44,7 +44,7 @@ program.command("audit").description("Verify every instruction claim against the
 );
 program.command("init").description("Onboard the truth guard: approve the baseline; scaffold AGENTS.md only if missing").option("-y, --yes", "accept defaults without prompting (never overwrites)").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./init-ISEFZWPV.js');
+    const { run } = await import('./init-OVLO4OBZ.js');
     await run({ cwd: resolveCwd(cmd), yes: opts.yes });
   })
 );
@@ -52,49 +52,49 @@ program.command("approve").description(
   "Re-approve the committed baseline after intentional structural changes (non-interactive)"
 ).action(
   (_opts, cmd) => action(async () => {
-    const { run } = await import('./approve-X3AW7KLD.js');
+    const { run } = await import('./approve-JEOEC2MV.js');
     await run({ cwd: resolveCwd(cmd) });
   })
 );
 program.command("scan").description("Deterministically reckon the project into a facts index").option("--json", "print the raw facts as JSON").option("--no-save", "do not write the .etymd cache").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./scan-ADZ2RKYY.js');
+    const { run } = await import('./scan-RAJUFTQR.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json, save: opts.save });
   })
 );
 program.command("doctor").description('Alias for `audit --truth` \u2014 "are the recorded instructions still true?"').option("--json", "print findings as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./doctor-EAA4IP4Y.js');
+    const { run } = await import('./doctor-C2RTL2QV.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("context").description("Measure the always-loaded context footprint and flag extraction candidates").option("--json", "print the budget as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./context-GYCLR3TG.js');
+    const { run } = await import('./context-4DGXO7JR.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("brief").description("Emit a grounded briefing for the in-repo agent to complete the semantic layer").option("--human", "write a human onboarding brief instead of the agent briefing").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./brief-RT6KE4CN.js');
+    const { run } = await import('./brief-ZK7TXAC4.js');
     await run({ cwd: resolveCwd(cmd), human: opts.human });
   })
 );
 program.command("ledger").description("List every tracked finding grouped by status (open \xB7 accepted \xB7 dismissed \xB7 \u2026)").option("--json", "print the raw ledger as JSON").action(
   (opts, cmd) => action(async () => {
-    const { list } = await import('./ledger-RHQJH5EA.js');
+    const { list } = await import('./ledger-TMIV45AA.js');
     await list({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("dismiss").argument("<finding-id>", "the finding id (from `etymd audit`) to dismiss").description("Dismiss a finding as a false positive / not applicable (hidden from future audits)").requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").action(
   (id, opts, cmd) => action(async () => {
-    const { dismiss } = await import('./ledger-RHQJH5EA.js');
+    const { dismiss } = await import('./ledger-TMIV45AA.js');
     await dismiss({ cwd: resolveCwd(cmd), id, reason: opts.reason });
   })
 );
 program.command("accept").argument("<finding-id>", "the finding id (from `etymd audit`) to accept").description("Accept a real finding as a known trade-off (hidden from future audits)").option("--reason <text>", "optional note on why the trade-off is accepted").action(
   (id, opts, cmd) => action(async () => {
-    const { accept } = await import('./ledger-RHQJH5EA.js');
+    const { accept } = await import('./ledger-TMIV45AA.js');
     await accept({ cwd: resolveCwd(cmd), id, reason: opts.reason });
   })
 );
@@ -111,7 +111,7 @@ var fleet = program.command("fleet").description(
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { sweep } = await import('./fleet-IS6YWDDV.js');
+    const { sweep } = await import('./fleet-YZGR4UC2.js');
     await sweep({
       cwd: resolveCwd(cmd),
       manifest: opts.manifest,
@@ -126,16 +126,35 @@ var fleet = program.command("fleet").description(
 );
 fleet.command("check").description("Validate the manifest pair only \u2014 no lenses: dangling mappings, duplicates, leaks").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").option("--json", "print the findings as JSON (EXPERIMENTAL through 0.2.x)").action(
   (_opts, cmd) => action(async () => {
-    const { check } = await import('./fleet-IS6YWDDV.js');
+    const { check } = await import('./fleet-YZGR4UC2.js');
     const opts = cmd.optsWithGlobals();
     await check({ cwd: resolveCwd(cmd), manifest: opts.manifest, json: opts.json });
   })
 );
+fleet.command("add").argument("<dir>", "directory of the project to register").description("Register a project \u2014 refuses to write an entry missing a mandatory field").option("--name <name>", "registered name (defaults to the directory's basename)").option("--kind <kind>", "entry kind (defaults to a value derived from the scan)").option("--profile <profile>", "personal | corp (default: personal)").option(
+  "--trust <level>",
+  "public-repo | public-bound | private \u2014 mandatory for personal entries"
+).option("-y, --yes", "skip prompts; every mandatory value must be passed as a flag").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
+  (dir, opts, cmd) => action(async () => {
+    const { add } = await import('./fleet-YZGR4UC2.js');
+    const shared = cmd.optsWithGlobals();
+    await add({
+      cwd: resolveCwd(cmd),
+      manifest: shared.manifest,
+      target: dir,
+      name: opts.name,
+      kind: opts.kind,
+      profile: opts.profile,
+      trust: opts.trust,
+      yes: opts.yes
+    });
+  })
+);
 fleet.command("dismiss").argument("<name>", "the registered project name").argument("<finding-id>", "the finding id (from `etymd fleet`) to dismiss").description(
   "Dismiss a project's finding from any cwd \u2014 corp ledgers persist beside the manifest"
 ).requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { dismiss } = await import('./fleet-IS6YWDDV.js');
+    const { dismiss } = await import('./fleet-YZGR4UC2.js');
     const opts = cmd.optsWithGlobals();
     await dismiss({
       cwd: resolveCwd(cmd),
@@ -150,14 +169,29 @@ fleet.command("accept").argument("<name>", "the registered project name").argume
   "Accept a project's finding as a known trade-off \u2014 corp ledgers persist beside the manifest"
 ).option("--reason <text>", "optional note on why the trade-off is accepted").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { accept } = await import('./fleet-IS6YWDDV.js');
+    const { accept } = await import('./fleet-YZGR4UC2.js');
     const opts = cmd.optsWithGlobals();
     await accept({ cwd: resolveCwd(cmd), manifest: opts.manifest, name, id, reason: opts.reason });
   })
 );
+program.command("screen").description(
+  "Content screen: check for text that must never be published. Bring your own patterns \u2014 etymd ships none."
+).option("--staged", "screen what a commit is about to add (default)").option("--tree", "screen every tracked file \u2014 what is about to leave the machine").option("--message <file>", "screen a commit message (the commit-msg hook's $1)").option("--dir <dir>", "screen an unpacked build artifact \u2014 what actually ships").option("--patterns <file>", "pattern file (default: ~/.config/etymd/screen-patterns)").option("--advisory", "report without failing").action(
+  (opts, cmd) => action(async () => {
+    const { run } = await import('./screen-U7JMWZPS.js');
+    const scope = opts.message ? "message" : opts.dir ? "dir" : opts.tree ? "tree" : "staged";
+    await run({
+      cwd: resolveCwd(cmd),
+      scope,
+      target: opts.message ?? opts.dir,
+      patterns: opts.patterns,
+      advisory: opts.advisory
+    });
+  })
+);
 program.command("gates").description("Install the local git-hook gates (process \u2192 pre-commit, correctness \u2192 pre-push)").option("--ci", "note about the CI review gate (ships later; local gates install now)").option("-y, --yes", "skip prompts; never overwrites a hand-edited hook").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./gates-3NPKF4IZ.js');
+    const { run } = await import('./gates-ILE4PXDA.js');
     await run({ cwd: resolveCwd(cmd), ci: opts.ci, yes: opts.yes });
   })
 );

package/dist/config-MX7OYI7F.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+export { CONFIG_FILE, DEFAULT_CONFIG, configPath, readConfig } from './chunk-NMZ3RHWW.js';
+import './chunk-R74SJ7HS.js';
+import './chunk-YLNQQZ5F.js';

package/dist/{context-GYCLR3TG.js → context-4DGXO7JR.js}

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
-import { readConfig, measureContext } from './chunk-ANCCGYSH.js';
-import './chunk-FZSIOCOZ.js';
-import { print, renderContext } from './chunk-LBRNZZZF.js';
+import { measureContext } from './chunk-LT67FU2Y.js';
+import { readConfig } from './chunk-NMZ3RHWW.js';
+import { print, renderContext } from './chunk-TADKOW6P.js';
+import './chunk-R74SJ7HS.js';
+import './chunk-YLNQQZ5F.js';
 
 // src/commands/context.ts
 async function run(opts) {

package/dist/doctor-C2RTL2QV.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { run } from './chunk-XTAX4YNT.js';
+import './chunk-V3DPLOOM.js';
+import './chunk-LT67FU2Y.js';
+import './chunk-WWBF4Y7K.js';
+import './chunk-NMZ3RHWW.js';
+import './chunk-TADKOW6P.js';
+import './chunk-R74SJ7HS.js';
+import './chunk-MKYPLNLH.js';
+import './chunk-NFENQ3IK.js';
+import './chunk-CRJHIXJH.js';
+import './chunk-YLNQQZ5F.js';
+
+// src/commands/doctor.ts
+async function run2(opts) {
+  await run({ cwd: opts.cwd, json: opts.json, truth: true });
+}
+
+export { run2 as run };

package/dist/{fleet-IS6YWDDV.js → fleet-YZGR4UC2.js}

@@ -1,18 +1,26 @@
 #!/usr/bin/env node
-import { dismiss, accept } from './chunk-EUIHYD6F.js';
-import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-SS7VGLJ5.js';
-import { readLedger } from './chunk-KBF3SW3N.js';
-import { DEFAULT_CONFIG } from './chunk-ANCCGYSH.js';
-import './chunk-E2Q7WFPN.js';
-import './chunk-C4Z6NXDO.js';
-import { ETYMD_DIR } from './chunk-FZSIOCOZ.js';
-import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph, pathExists, readText, isDirectory, git } from './chunk-LBRNZZZF.js';
+import { dismiss, accept } from './chunk-MMPV67FW.js';
+import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-V3DPLOOM.js';
+import './chunk-LT67FU2Y.js';
+import { readLedger } from './chunk-WWBF4Y7K.js';
+import { DEFAULT_CONFIG } from './chunk-NMZ3RHWW.js';
+import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph } from './chunk-TADKOW6P.js';
+import { ETYMD_DIR } from './chunk-R74SJ7HS.js';
+import { scanProject } from './chunk-MKYPLNLH.js';
+import './chunk-NFENQ3IK.js';
+import './chunk-CRJHIXJH.js';
+import { readText, pathExists, git, isDirectory } from './chunk-YLNQQZ5F.js';
 import { promises } from 'node:fs';
 import path from 'node:path';
+import { select, isCancel, cancel, text, confirm } from '@clack/prompts';
 import os from 'node:os';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 
+var FLEET_TRUST_VALUES = ["public-repo", "public-bound", "private"];
+function isFleetTrust(value) {
+  return typeof value === "string" && FLEET_TRUST_VALUES.includes(value);
+}
 function expandTilde(p) {
   if (p === "~") return os.homedir();
   if (p.startsWith("~/")) return path.join(os.homedir(), p.slice(2));
@@ -108,7 +116,10 @@ function loadRegistryEntries(projects, manifest, manifestFile) {
       private: rec.private === true,
       path: asString(rec.path),
       upstream: asString(rec.upstream),
-      trust: asString(rec.trust),
+      // An unknown value is NOT coerced to a default: trust gates content screening, so a typo
+      // must surface as "undeclared" (a finding) rather than quietly picking an answer.
+      trust: isFleetTrust(rec.trust) ? rec.trust : void 0,
+      trustRaw: asString(rec.trust),
       staleAfterDays: typeof rec.staleAfterDays === "number" ? rec.staleAfterDays : void 0,
       stateBudget: typeof rec.stateBudget === "number" ? rec.stateBudget : void 0,
       contract,
@@ -225,6 +236,24 @@ async function loadFleetManifest(manifestPath) {
     manifest.machineProfile = local.data.machineProfile === "corp" || local.data.machineProfile === "personal" ? local.data.machineProfile : void 0;
     const rootRaw = asString(local.data.root) ?? asString(parsed.root);
     if (rootRaw) manifest.root = path.resolve(dir, expandTilde(rootRaw));
+    const orientationRec = asRecord(parsed.orientation);
+    if (orientationRec) {
+      const orientationRoot = asString(orientationRec.root);
+      if (orientationRoot) manifest.orientation = { root: orientationRoot };
+      else {
+        manifest.problems.push({
+          kind: "bad-shape",
+          file: manifestFile,
+          detail: "`orientation` declares no `root` name \u2014 the fleet's orientation cannot be resolved"
+        });
+      }
+    } else if (parsed.orientation !== void 0) {
+      manifest.problems.push({
+        kind: "bad-shape",
+        file: manifestFile,
+        detail: '`orientation` must be an object (`{ "root": "<name>" }`) \u2014 ignored'
+      });
+    }
     loadRegistryEntries(parsed.projects, manifest, manifestFile);
   } else if (Array.isArray(parsed.sources)) {
     manifest.shape = "corpus";
@@ -367,6 +396,19 @@ async function checkManifest(manifest) {
       );
     }
     seen.add(entry.name);
+    if (entry.profile !== "corp" && !entry.private && !entry.trust) {
+      const bad = entry.trustRaw;
+      findings.push(
+        finding(
+          `${FLEET_LENS}/${bad ? "unknown-trust" : "undeclared-trust"}:${entry.name}`,
+          "risk",
+          bad ? `\`${entry.name}\` declares unknown trust \`${bad}\`` : `\`${entry.name}\` declares no \`trust\``,
+          [`${manifestFile}: ${entry.name}${bad ? `.trust = ${bad}` : " has no trust field"}`],
+          "Trust decides whether content screening applies. An unanswered entry is not a private one \u2014 publishing exposes ALL history, so a repo that went public without ever answering is exactly what a default would hide.",
+          `Declare one of ${FLEET_TRUST_VALUES.map((t) => `\`${t}\``).join(", ")}.`
+        )
+      );
+    }
     if (entry.private && entry.path) {
       findings.push(
         finding(
@@ -421,6 +463,18 @@ async function checkManifest(manifest) {
       }
     }
   }
+  if (manifest.orientation && !seen.has(manifest.orientation.root)) {
+    findings.push(
+      finding(
+        `${FLEET_LENS}/dangling-orientation:${manifest.orientation.root}`,
+        "gap",
+        `\`orientation.root\` names \`${manifest.orientation.root}\`, which is not a registered name`,
+        [`${manifestFile}: orientation.root = ${manifest.orientation.root}`],
+        "Every entry is guided by the orientation root implicitly \u2014 if it resolves to nothing, the whole fleet's orientation is a claim nothing can follow.",
+        "Point it at a registered name, or drop the block if this fleet has no orientation root."
+      )
+    );
+  }
   for (const name of Object.keys(manifest.localDirs)) {
     if (manifest.shape === "registry" && !seen.has(name)) {
       findings.push(
@@ -631,6 +685,52 @@ async function checkCorpEmails(manifest, findings, disclosures) {
     }
   }
 }
+async function checkGateDrift(manifest, findings, disclosures) {
+  const { planWorkflow } = await import('./generate-IYCQETQB.js');
+  const { scanProject: scanProject2 } = await import('./scan-ZYZ7XDSJ.js');
+  const { readConfig } = await import('./config-MX7OYI7F.js');
+  for (const entry of manifest.entries) {
+    const root = entry.resolvedRoot;
+    if (!root || !await isDirectory(root)) continue;
+    if (entry.profile === "corp" || entry.private) continue;
+    const facts = await scanProject2(root);
+    if (!facts.git.isRepo) continue;
+    if (facts.hooks.source === "husky" || facts.hooks.source === "husky-legacy") {
+      disclosures.push(
+        `${entry.name}: hooks managed by ${facts.hooks.source} \u2014 gate drift not comparable against the .githooks pack`
+      );
+      continue;
+    }
+    const { config } = await readConfig(root);
+    const planned = (await planWorkflow(root, facts, { agents: false, gates: true, gateConfig: config.gates })).filter((f) => f.executable);
+    const missing = planned.filter((f) => !f.exists).map((f) => f.path);
+    const stale = planned.filter((f) => f.exists && f.differs).map((f) => f.path);
+    if (missing.length) {
+      findings.push(
+        finding(
+          `${FLEET_LENS}/gate-missing:${entry.name}`,
+          "gap",
+          `\`${entry.name}\` is missing ${missing.length} gate${missing.length === 1 ? "" : "s"} the pack would install`,
+          missing.map((m) => `${entry.name}: no ${m}`),
+          "A gate absent in one repo is invisible from inside it \u2014 every commit there skips a check its siblings run.",
+          "Run `etymd gates` in that repo."
+        )
+      );
+    }
+    if (stale.length) {
+      findings.push(
+        finding(
+          `${FLEET_LENS}/gate-stale:${entry.name}`,
+          "polish",
+          `\`${entry.name}\` has ${stale.length} gate${stale.length === 1 ? "" : "s"} that differ from what its own inputs generate`,
+          stale.map((s) => `${entry.name}: ${s}`),
+          "A hand-edited or outdated hook drifts from the pack silently \u2014 the repo believes it runs checks the file no longer contains.",
+          "Re-run `etymd gates` (it asks before overwriting), or record the intent in .etymd/config.json."
+        )
+      );
+    }
+  }
+}
 async function collectWallFindings(manifest) {
   const findings = [];
   const disclosures = [];
@@ -639,6 +739,7 @@ async function collectWallFindings(manifest) {
   await checkManifestRepoMachinePaths(manifest, findings, disclosures);
   await checkHygieneNeedles(manifest, findings, disclosures);
   await checkCorpEmails(manifest, findings, disclosures);
+  await checkGateDrift(manifest, findings, disclosures);
   return { findings, disclosures };
 }
 function stateAgeDays(facts) {
@@ -971,6 +1072,138 @@ async function check(opts) {
   renderFindings(findings);
   renderFleetNotes([], disclosures);
 }
+async function add(opts) {
+  const { manifest, autoNote } = await loadManifest(opts.cwd, opts.manifest);
+  if (autoNote) print(`  ${theme.dim(`\u25E6 ${autoNote}`)}`);
+  if (manifest.shape !== "registry") {
+    throw new Error("`fleet add` targets the registry shape \u2014 this manifest is a legacy corpus");
+  }
+  const raw = await readText(manifest.manifestPath);
+  if (raw === null) throw new Error(`cannot read ${manifest.manifestPath}`);
+  const absTarget = path.resolve(opts.cwd, opts.target);
+  if (!await pathExists(absTarget)) throw new Error(`no such directory: ${absTarget}`);
+  const name = opts.name ?? path.basename(absTarget);
+  if (manifest.entries.some((e) => e.name === name)) {
+    throw new Error(`\`${name}\` is already registered \u2014 resolution is keyed by name`);
+  }
+  const facts = await scanProject(absTarget);
+  const remote = facts.git.isRepo ? await git(absTarget, ["remote", "get-url", "origin"]) : null;
+  section(`Fleet add ${theme.dim(`\xB7 ${name} \xB7 ${absTarget}`)}`);
+  let profile = opts.profile;
+  if (!profile && !opts.yes) {
+    const picked = await select({
+      message: "Which side of the wall does this belong to?",
+      initialValue: "personal",
+      options: [
+        { value: "personal", label: "personal \u2014 your own work" },
+        { value: "corp", label: "corp \u2014 employer work (alias-only, machine-pinned)" }
+      ]
+    });
+    if (isCancel(picked)) {
+      cancel("No entry written.");
+      return;
+    }
+    profile = picked;
+  }
+  profile = profile ?? "personal";
+  if (profile !== "personal" && profile !== "corp") {
+    throw new Error(`--profile must be personal or corp, got \`${profile}\``);
+  }
+  const derivedKind = facts.commands.build || facts.commands.test ? "tool" : "repo";
+  let kind = opts.kind;
+  if (!kind && !opts.yes) {
+    const known = [...new Set(manifest.entries.map((e) => e.kind).filter(Boolean))];
+    const choices = [.../* @__PURE__ */ new Set([derivedKind, ...known])];
+    const picked = await select({
+      message: "Kind?",
+      initialValue: derivedKind,
+      options: [
+        ...choices.map((k) => ({
+          value: k,
+          label: k === derivedKind ? `${k} \u2014 matches this repo's shape` : k
+        })),
+        { value: "", label: "something else\u2026" }
+      ]
+    });
+    if (isCancel(picked)) {
+      cancel("No entry written.");
+      return;
+    }
+    kind = picked;
+    if (!kind) {
+      const typed = await text({
+        message: "Kind (free text):",
+        validate: (v) => v.trim() ? void 0 : "a kind is required"
+      });
+      if (isCancel(typed)) {
+        cancel("No entry written.");
+        return;
+      }
+      kind = typed.trim();
+    }
+  }
+  kind = kind ?? derivedKind;
+  let trust;
+  if (profile === "personal") {
+    trust = opts.trust;
+    if (!trust && !opts.yes) {
+      const picked = await select({
+        message: "How exposed is this repo's history? (gates content screening)",
+        options: [
+          { value: "private", label: "private \u2014 not destined to be published" },
+          { value: "public-bound", label: "public-bound \u2014 private now, plausibly public later" },
+          { value: "public-repo", label: "public-repo \u2014 already public" }
+        ]
+      });
+      if (isCancel(picked)) {
+        cancel("No entry written.");
+        return;
+      }
+      trust = picked;
+    }
+    if (!trust) {
+      throw new Error(
+        `\`${name}\` needs a trust level: pass --trust <${FLEET_TRUST_VALUES.join("|")}> (non-interactive runs cannot be prompted, and there is deliberately no default \u2014 trust gates content screening)`
+      );
+    }
+    if (!isFleetTrust(trust)) {
+      throw new Error(`--trust must be one of ${FLEET_TRUST_VALUES.join(", ")}, got \`${trust}\``);
+    }
+  } else if (opts.trust) {
+    throw new Error("corp entries take no `trust` \u2014 `profile: corp` already implies it");
+  }
+  const entry = profile === "corp" ? { name, kind, profile, private: true } : {
+    name,
+    kind,
+    profile,
+    path: path.relative(manifest.root ?? manifest.dir, absTarget),
+    trust,
+    contract: {},
+    links: {},
+    // The scan does not collect remotes (they are not a workflow fact), so read it here —
+    // recorded when present, simply absent when the repo has no origin yet.
+    ...remote ? { remote } : {}
+  };
+  print(`  ${glyph.bullet} ${theme.dim("entry")}`);
+  print(
+    JSON.stringify(entry, null, 2).split("\n").map((l) => `    ${theme.dim(l)}`).join("\n")
+  );
+  if (!opts.yes) {
+    const ok = await confirm({
+      message: `Write this entry to ${path.basename(manifest.manifestPath)}?`
+    });
+    if (isCancel(ok) || !ok) {
+      cancel("No entry written.");
+      return;
+    }
+  }
+  const doc = JSON.parse(raw);
+  if (!Array.isArray(doc.projects)) throw new Error("manifest has no `projects` array to append to");
+  doc.projects.push(entry);
+  await promises.writeFile(manifest.manifestPath, JSON.stringify(doc, null, 2) + "\n", "utf8");
+  print(`  ${glyph.ok} ${theme.dim("registered")} ${theme.info(name)}`);
+  print(`  ${theme.dim(`verify with \`etymd fleet check --manifest ${manifest.manifestPath}\``)}`);
+}
 async function resolveFleetFinding(opts, status) {
   if (status === "dismissed" && !opts.reason?.trim()) {
     throw new Error('dismiss needs a reason: etymd fleet dismiss <name> <id> --reason "\u2026"');
@@ -1001,4 +1234,4 @@ async function accept2(opts) {
   await resolveFleetFinding(opts, "accepted");
 }
 
-export { accept2 as accept, check, dismiss2 as dismiss, sweep };
+export { accept2 as accept, add, check, dismiss2 as dismiss, sweep };